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1-3 • Though late, OCC comments 
regarding the APEX Industrial 
Security Manual are not unlike 
what vre have heard fron other 
components especially with re- 
gard to the lack of specificity. 
You may wish to review quickly 
for your information* 
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A l 


11 April 1979 


MEMORANDUM FOR: 


FROM: 


SUBJECT: 


CIA Member , Industrial Security 
Manual Working Group 

Logistics & Procurement Law Division 
Office of General Counsel 

APEX Industrial Security Manual 


1. Per your request we have reviewed the proposed APEX 
Industrial Security Manual. In addition to notations made in 
the Manual drafts our comments follow: 

a. Page 1 - The citations to the National 
Security Act of 1947 and Executive Orders 12036 
and 12065 are Informal and should be placed in 
proper form. The correct citations are as 
follows: National Security Act of 1947, Pub. L. 

No. 80 - 253 , 61 Stat . 495> as amended; Executive 
Order No. 12036 , 43 Fed. Reg. 3674 (1978); 

Executive Order No. 12065., 43 Fed. Reg. 28949 
(1978). 

b. Page 1 - We are puzzled as to the exact 
status this Manual will have since it "will serve 
as the authorative guide," while, at the same 
time, the guide, "is not, however, intended to 
intrude on the authority of government Program 
Managers who 'will continue to prescribe basic 
operational direction, classification guidance 
and policy on dissemination for programs under 
their cognizance." Exactly what authority or 
weight will this guide convey? 

c. Page 2 - It is unclear to this Office 
whether the "personal responsibility" referred to 
here is meant to infer legal liability or merely 


y? ij i $■&) ca a » 
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the moral restraint placed upon these individuals 
to safeguard this information. If legal liability 
is the intent * this section should be carefully 
coordinated with this Office prior to publication 
of the Manual. 

d. Page 9, paragraph 3 - Time limits should 
be added as to when tracers will be sent . 

e. Page 10, paragraph 5 - The paragraph 
fails to state who will receive the reindoctrina- 
tlons. Clarification is required here. 

f. Page 11, paragraph 8 - The term "required 
reports" is vague and gives no real clue as to what 
reports are required and by whom. 

g. Page 13, last paragraph - "Common sense 
determinations" Is a vague term to be using in so 

"X sensitive an area as in the granting of exceptions 
for access privileges. 

h. Page , paragraph c - Who will conduct 
these investigations? Also, the phrase, "but not 

^ limited to," should be added between the words 

"include" and "birth" so as to not make the list an 
exclusive listing. 

i. Page 18, paragraph 12 - The spouse or 
Immedi ate family chec k discussed here must be examined 

25X1 by I ^ I Office of General Counsel, to 

determine if it complies with current law. A copy of 
the Manual draft has been provided to him for comment. 

j. Page 23 9 paragraph e2. - Same comment as 
above in paragraph I. 

k. Page 26 - We are unclear as to how this 
Manual interfaces with the newly issued Industrial 
Security Manual of the Office of Security. Will a 
copy of this Manual be provided a contractor or 
potential bidder? Problems in the past have occurred 
regarding enforcement of security practices when it 
was learned that the contractor was not given a copy 
of the particular manual involved. 


V *•»> * 6 s ^ X-» i> ■' *•* 
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l. Page 27, line 7 ~ In the phrase, "cognizant 
Agency review," does Agency refer to the CIA? If so, 
will other Intelligence Community members be required 
to accept the CIA review? How will an increase in 
foreign ownership above the five percent mark be 
discovered? 

m. Page 28, line 12 - Should read "or" vice "of." 

n. Page 32, paragraph a - Appendix A was not 
provided. 

o. Page 32, paragraph c - Periodic is too vague. 

Be specific in order to be enforceable. 

p. Page 35, line 1 - "May be" is permissive. 
Suggest "must" be substituted. 

q. Page 35, line 11 - The acronym "ACF" is 
undefined . 

r. Page 35, paragraph a, line 2 - Phrase "as 
soon a.s possible" is vague . Suggest a minimum time be 
established in order to be enforceable. 

S. Page 36, paragraph a, line 5 - "As a mimimum" 
added to permit reinspections as needed without raising 
claim of interference. Sentence would read "Reinspec- 
t-ions are to be conducted every 18 months as a minimum," 

t. Page 38, paragraph a - Delete "sole" as two 
different persons are empowered to certify. 

u. Page 38, paragraph c - Who will provide the 
necessary support to maintain a Central Access Approval 
Registry? 

v. Page 42, paragraph c - Who will exercise final 
review and resolve these challenges? 

w. Page 49, paragraph f - Delete "As soon as 
possible" as such language is precatory. Suggest a 
time limit be defined to make it enforceable . 


3 
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x. Page 56, paragraph, a* line 9 - Delete "in 
timely fash ion" as it is precatory. Establish a 
time limit . I I 


2. If you require clarification of the above comments 
or wish further review of t he Manu al by this Office, please do 
not hesitate to contact us. [ 


Assist'ant General Counsel 


Att . 
Manual 



25X1 


Special Asst., OGC 
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[SECURITY lyiOLATIQU , Any breach of secu- 
rity regulations, requirements, procedures or 

: J: 

guides by an Individual vhlch subjects classi- 
fied or sensitive material or information to 

■ V, l! " 

, ... fl : 

compromise to unauthorized persons, or which 


IF 

places it In ,1e 


where a compromise could 


result, constitutes a security violation. Such 
a breach includes both acts of omission such as 
failure to properly secure classified or sensi- 
tive material jland acts of commission such as 
discussion of classified or sensitive informs- . 
tlon over non secure telephone circuits. The 
information and materials referred to in thi3 
definition comprise classified materials and 
those materials and Information which are 
sensitive because they involve intelligence 
sources and methods. 
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eating authorized access to restricted areas 


be rigidly "controlled and "accounted' for’ "b; 


■EHiT contracto? by use of badge stock utilizing a 


system. In addition, ^adge blanks’ and "relate 


> I* ' . .. 

g matcfrfnls' shail~~alsb' bg"»j|ecurelyj g 

• •!' j , ' 

ed ”afjd stored .'; 

Where a badge system la used, the 


Contractor will ensure that a badge check ls~-- 


;i.! 

.conducted. ohi^all.-personneLLentering-and-exltln 


Customer-dedicated contractor facilities (facil 


ities used exclusively by the Customer). 





/• d. The Contractor shall .mlntairTlogy ' 
(Identifying alll personnel'enterl'n^'and "leaving . ' 

([Contractor "bulldii ngir and restricted arcaa 

yhereln C uatowej related actlvltlea are con- . 
_ducted specifically during nonworking hours 

: r ;» 

and other period s deemed appropriate by the Con- 
tracting Officers Security Representative 
and/or Contra ctor. These logs should be 
rscrutlnlzed regu l arly for" suspicious anomall'eT 
and should be ^Vained" &~~mlniiauB ~of * five ’yteraTg 
or until such, time as otherwise specifically 
agreed upon between the Customer and Contractor. 


|i • 
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. B, ■ RECEIPT^'ifOR CLASSIFIED DOCyMENTS 

a. A: duplicate copy of all* receipt a'forj 
. rCustbmeF classified- documents sent' to~ the - 
. .fcustomer by tho Contractor or cent from one • 
Customer Contractor to another Customer Contrac- : 
tor or subcontractor shall be fetalned‘in-*'a 
f-. suspense •.flleli.until the signed- copy is returned^ 
fA su'spense'ida'j.e'riot to 'exceed 20'Vorklrigdaya' 
shall" he eatabllshed.and follow-up action s 

“T” ' 

jshall bc-~iriitlated by the' originator If "the * 
rafgned receipt- Is not received within that time . 
In addition, Iflie Contractor shall ensure that 
any classified documents or material vhich he 
receives eithby from the Customer or from 
.■ another Customer Contractor or subcontractor are 


\ ■-= 

is returned tc 

the sender within 20 working 

days'. ^Follow- 

UP action will be -required if that 

vi 

Itime'isexceed 

edTj - ■; ■ 


,ij 


t 


ThiB paragraph has been added to make 
■this Manual consistent vith the I I Manual, 
by including the 20 working days' suspense 
requirement for document and materials 
tracer action. 


ssmsm 


■ b. -Destruction of classified documents and 


A* S_e3frfuctlon,of classified documents and. 


action is contrary to local ordinances or would 
involve safety hazards, advice should be 
requested from the Contracting Officer's 
v_/burity Representative. Destruction may be • 
performed only by persons holding appropriate 
Industrial Security Approvals granted by the 
Agency. Although certificates of destruction 
are not required, the date and initials of the 
destroyer must be noted in the log when CONFI- 


tb y the Customer When such action i3 contrary 
to local or8ij|ances or would involve safety 
hazards, advice should be requested from the 
Contracting Officer's Security Representative. 
Destruction may be performed only by persons 
holding appropriate Industrial Security Approv- 
>als granted by the Customer . Although certifi- 
cates of destruction are not required, the date 
and signatures of the destroyer and a witness to 


DEHTIAL or SECRET documents are destroyed. Two the destruction are required in the log to 
signatures are required in the log to certify certify the destruction of CONFIDENTIAL . 

‘^c destruction of TOP SECRET material. 


SECRET, and -TOP SECRET material .. 

.■■''I. • -I 

• The persons performing the .destruction of 

classified materials shall remain at the 

destruction site until the destruction is 

complete and a determination has' been made that 

the material cannot, be reconstituted . 

v 4 : f'iV -f. •,••• ••.. • • 

;• ;j- 'VvSiH'Jr.'Zt&i 


' This paragraph has been expanded to 

require that the destruction of all classi- 
fied materials be witnessed and that the 
signatures of the destroyer and the witness 
\ be entered into the Document Control Dog. 

We have also added the requirement that the 
. persons performing the destruction remain at 
the site as specified. 
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lg . REPORTING .SECURITY VIOLATIONS 


. ^liTT icur^ty 'viol at i on 3 , as defined In ■ This is a new paragraph containing 

paragraph 3 of thl3 Manual are^to s be reported i the requirements. for reporting of security 

• Ifry 'the Contractor 1 s' Security Hepreaentatlve ' tc^ . violations. It will he included in all the 


(the' Contractlng'Offlcer 1 s Security Representa- 


^ tive.^In cases ' involving Communications Security 
.matters, and li^ cases where other aerioua 
■ compromise of classified information is believed 
to have occurred, an Initial telephonic report 
’(unclassified* in content) shall be made hy the 
Contractor t.o the Customer. In such cases . 
where the Contractor has an encrypted conununica- 
tlons link with, the Customer, a report by wire 
shall also be provided the Customer. In every 
case, the Contractor shall complete and forward 
to the cognizant Customer Security Officer a 


Security Violation Report Form for Customer 




mi • 






PSA-approved aecurlty/contalner^ or In tvo 
independently controlled drawers of the same 


PSA-approved aocurity container. Control of the 


combinations in to be vested in the highest 


level of the Contractor's Security Staff having 


' \l ' 

responsibility | for the protection of the con- 

.-■if- 

.tract. Combinations shall be disclosed only to . 

’ i ~ r i 

and changed by. persona holding appropriate 


Industrial Security Approvals from the Customer . 
Combinations snjat not be recorded : on telephone 
list finders calendar padst or in other non- 
secure placed. :1. 


1. The .Contractor shall ensure that 

' Customer classified documents , material and 

• }|« 

equipment,- vhen in use, are constantly under the 

control of appropriately approved and briefed •. 

/'.-.Jr;, • ■ ' • ' : - 

personnel', and when not In use, are stored In & 

-i. 

manner approved by the Contracting Officer^ 
Security Representative. Where determined 
applicable* by J the cognizant Headquarters Secu- • 
rlty Officer y 'the "Two-Person Rule". Bhall be, ’ .. 
renforcedt’Ty ■% - . 


























V; The Oon traetor shall Initiate tu, ' ' : 

i".:'. — lntain a program to ensure that rkey'Sosltlnnn"? ' 

• ■ s uch as gomwunicator ; document control alerfrnn,^ 
vfc^l WWatdffed V ■emr,loy e eaTofV,r« w .n ^ •’ 
{n^turlty and „tabllltv:? Th ese duties a™ 
co nsidered segondarv t o other reapnnalbllitics - 
— - ever y e * ort ‘ must be Md, to a33 j gn t.n tlw » 
2.03ition3/-peopj.e w ho' have an aptitude -fnyi . . - • • " 

g duch work.’/'To the e x tent feasible these fi.nn- ’ 
,t l ons should faaalgne d to separate i>eraon n el If 


M 
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v» The Contractor shall periodically have 
..■ each^upervlsor-tntgnrleVhls or her subordl- / ' 
IjP 0 ^ 8 '. J ^p^retnforce security cohsclousnesa'and' to 
^surface potentia^"securlty problem8.? Any 
problema discerned vhleh are considered to have 
a potential impact upon security shall tie 
brought" immediately to the attention of the / 
(Contract ing Of floor* a Security Representative -'? 



• • ;i v. !i;JL . • 


. v» The Contractor shall periodically have . 

- • each /supervisory Interview his or her s’ubordl- * 7 
^nates to 'reinforce security consciousness "and . tcT 
^ 'surface •potential ’security _ problems'. 7 Any 
problems discerned vhlch are considered to have . 
a potential impact upon security shall be 
Brought immediately to the attention of the ; 
'Contracting Officer^ Security Hepreaentatlve .i 
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. — — The Con tradtor shall ensure that ... .-r.v 

. ; ; V £g. ntfa5t6i, ^ecurlty -han gers develop • djj^riggg. ’* j : 

/S? nt '~ a program of ~^ lSae~~rapporf and"tf^ -Q 
•; . y jPvpervlnl5n-6^r>on t^ct or - eomnn , n1pntM L - r .. '•! * ’ • ‘ 

, ^S^rantrol -and/or s t 0 rn ^ e . clerka^^QH^- ^ 
V — ■ ° thor Personnel the Co ntractor or i!iiL.f. 

• iJS Officer^ Secur ity Representative ridv 
d eolflnate as oecti py I n e n n It 1 ve~po s 1 t'feh • 

P eriodic counsellin g informal Job orieHtnrt 
j* SCU33< -?na and clos e attention to the ■ 

' daily duties and J oWelate^ftctlvl- 
tl_ ea are recommended In the development . ^ . 

• Contractor^ security tiro^mm. 


lie'll 


$*?•: • . : -T; [ - - 







closed * p, . • ' 

,i" •.* To the cxtcLt -practicable, ^eroonnoi ohall?.. 


fgrrstgtga-BQ that t'he name two indlvldualo aro n'boor'bea fry the sponsoring office . "(Eaohaals 










• • With respect to 'Contractor" CourlbrET'' the 

jfvTo^Paraon-Rule-alao-appllea to the movement of 
■ 1 TOP SECRET classified materials ,7arid~WtiSn^ 
^deslKnatedby the Customer ,*^0 SECRET, bind; 

? CONFI DEWTi AL ~rnat eritil a r\ ; . 

• *In determining a designated areal the 
Customer shall take Into consideration the 
sensitivity and/or volume of the material being 
stored and, as appropriate, the sensi-faivlty ' 

• .of an activity being conducted In a given area . . 
As a general practice, the Two-Person feule shall 
be applied to document storage areas , Equipment 
fabrlcatlon/assembly areas , document rfeproduc- 


tion areas and any other areas dctermlhed appli- 
cable because of the o en a it lvlty/ volumb of the 
material being stored or sensitivity of* activity 


conducted therein. 





The contractor shall ensure that appro- 


priate logs are maintained to reflect that the 
Two-Person Rule has actually been enforced at .. 


all locations where It is applicable. The Ioro 
shall he designed to reflect who the two 
jartlca to. the Two-Person Rule were at any . 


riven time an area or piece of storage equip- > 


tnent was being opened, wa3 In U3e. or was belnft 
closed. 





